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WHAT IS CLAIMED IS: 

An apparatus for passively measuring the time required for one or more data packets to 
traverse a network device in a network, said network device communicatively 
connectable to said network, comprising: 

a first network connection for communicatively connecting with said network and 
for detecting an incoming data packet arriving at said network device; 

a second network connection for communicatively connecting to said network and 
for detecting an outgoing data packet departing from said network device; 

a correlator for correlating said incoming data packet with said outgoing data 
packet; and 

a calculator for calculating a latency period between detecting said incoming data 
packet and detecting said outgoing data packet. 

The apparatus of claim 1 wherein said calculator further comprises: 

an electronic memory for storing a first timestamp associated with said incoming 
data packet and second timestamp associated with said outgoing data packet wherein the 
calculator is for calculating said latency period based on the difference between said first 
and second timestamps. 

The apparatus of claim 1 wherein said correlator is for comparing said incoming data 
packet with said outgoing data packet to determine whether said incoming data packet 
and said outgoing data packet represent at least partially the same data packet at different 
stages of transit. 

The apparatus of claim 3 wherein said correlator includes a means for comparing a data 
packet checksum of said incoming data packet with a data packet checksum of said 
outgoing data packet. 
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The apparatus of claim 3 wherein said correlator includes a means for comparing a data 
segment spanning one or more data packets of an incoming data stream with a data 
segment spanning one or more data packets of an outgoing data stream. 

The apparatus of claim 3 wherein said correlator includes a means for comparing a source 
or destination network address of an incoming data packet with an entry in a network 
address translation table to correlate said incoming data packet with an outgoing data 
packet having a corresponding source or destination network address entry in said 
network address translation table. 

A method for passively measuring a latency for a network device in a network wherein 
said network device is communicatively connectable to said network, said method 
comprising the steps of: 

detecting an incoming data packet for said network device; 

storing a first timestamp for said incoming data packet; 

detecting an outgoing data packet from said network device; 

storing a second timestamp for said outgoing data packet; 

correlating said incoming data packet with said outgoing data packet; and 

calculating said latency for said network device based on said first timestamp and 
said second timestamp. 

The method of claim 7 wherein said correlating step further comprises comparing a data 
packet checksum from said incoming data packet with a corresponding data packet 
checksum from said outgoing data packet. 

The method of claim 7 wherein said incoming data packet is a stream of data packets 
from an application layer request and said outgoing data packet is a corresponding stream 
of data packets from an application layer response. 
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The method of claim 9 wherein said correlating step further comprises comparing a data 
segment spanning one or more data packets of said incoming data stream with a data 
segment spanning one or more data packets of said outgoing data stream. 

The method of claim 7 wherein said correlating step further includes comparing a source 
or destination network address of an incoming data packet with an entry in a network 
address translation table to correlate said incoming data packet with an outgoing data 
packet having a corresponding source or destination network address entry in said 
network address translation table. 

A computer program product for passively measuring the time required for a data packet 
to traverse a network device, comprising: 

instructions for detecting an incoming data packet arriving at said network device; 
instructions for storing a first timestamp for said incoming data packet; 
instructions for detecting an outgoing data packet departing from said network 

device; 

instructions for storing a second timestamp for said outgoing data packet; 

instructions for correlating said incoming data packet with said outgoing data 
packet; and 

instructions for calculating a latency for said network device based on said first 
timestamp and said second timestamp. 

An apparatus for passively measuring a latency for a network device in a network 
wherein said network device is communicatively connectable to said network, 
comprising: 

means for replicating a pre-processed data packet incoming to said network 

device; 
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means for storing a first timestamp for said pre-processed data packet; 

means for replicating a processed data packet departing from said network device 
wherein said processed data packet represents the pre-processed data packet after said 
pre-processed data packet has been processed by said network device; 

means for storing a second timestamp for said processed data packet; 

means for correlating said pre-processed data packet and said processed data 
packet; and 

means for calculating said latency for said network device based on said first 
timestamp and said second timestamp. 

A method for passively measuring a latency for a network device in a network wherein 
said network device is communicatively connectable to the network, said method 
comprising the steps of: 

detecting an incoming data packet arriving at said network device; 

storing a first timestamp for said incoming data packet; 

determining a first type for said incoming data packet; 

obtaining a first identifier based on the contents of said incoming data packet; 

detecting an outgoing data packet departing from said network device; 

storing a second timestamp for said outgoing data packet; 

determining a second type for said outgoing data packet; 

obtaining a second identifier based on the contents of said outgoing data packet; 
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comparing said first type with said second type and said first identifier with said 
second identifier to correlate said incoming data packet with said outgoing data packet; 
and 

calculating said latency for said network device based on said first timestamp and 
said second timestamp. 

15. The method of claim 1 4 wherein said first identifier is a data packet checksum from said 
incoming data packet and said second identifier is a data packet checksum from said 
outgoing data packet. 

16. The method of claim 14 wherein said first identifier is a data packet string segment from 
said incoming data packet and said second identifier is a data packet string segment from 
said outgoing data packet. 

17. The method of claim 14 wherein said correlating step further includes comparing a source 
or destination network address of an incoming data packet with an entry in a network 
address translation table to correlate said incoming data packet with an outgoing data 
packet having a corresponding source or destination network address entry in said 
network address translation table. 
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A method for passively measuring the time required for one or more application data 
packets to traverse a network device in a network, said network device communicatively 
connectable to said network, comprising: 

detecting an incoming application data packet for said network device; 
storing a first timestamp for said incoming application data packet; 
determining a first application service for said incoming application data packet; 
detecting an outgoing application data packet from said network device; 
storing a second timestamp for said outgoing application data packet; 
determining a second application service for said outgoing application data 

packet; 

correlating said incoming data packet with said outgoing data packet wherein said 
correlation is based on said first application service and said second application service 
and wherein said correlation is based on a first application data packet string segment for 
said incoming application data packet and a second application data packet string 
segment for said outgoing application data packet; and 

calculating a latency for said network device based on said first timestamp and 
said second timestamp. 
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